WQuake[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
WQuake.exe
Size 1.2MB
Sample260628-wgrc2aa12l
SHA256 fd4226713dadac14bef4cc0f353218fe5890474907501d39207de2d93ce1ff59
MD5 d0b2f39f5d98c612cc40c2bff8b84bd2
SHA1 315d932f8bec29fc3734eddc47db40dab34fb9f8
SHA512 04300c13a42a9c25892b1323d6dd388e78fda8d9759777095dff605a6c47b264faeaadf569b2b535cdfe901dde785193e352bcf8913ba9b40209b7ecaeaa75bd
SSDEEP 24576:FOGsmRxZUsyIj+lOraQPCrraByOmJ+oPwCPvQ:FIm5ULtlQaa/mrPwA
TLSH
T17E556C96A7A401EDC077C1F8C957D623E776BC091321AADB06D2F9662FB36E15B39300
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
WQuake.exe

File Explorer

WQuake.exe

.exe 1.2MB

WQuake.exe

IMPHASH 7ce53fc74f8eef47d500cb3969036c55
SHA256 fd4226713dadac14bef4cc0f353218fe5890474907501d39207de2d93ce1ff59
MD5 d0b2f39f5d98c612cc40c2bff8b84bd2
SHA1 315d932f8bec29fc3734eddc47db40dab34fb9f8
SHA512 04300c13a42a9c25892b1323d6dd388e78fda8d9759777095dff605a6c47b264faeaadf569b2b535cdfe901dde785193e352bcf8913ba9b40209b7ecaeaa75bd
SSDEEP 24576:FOGsmRxZUsyIj+lOraQPCrraByOmJ+oPwCPvQ:FIm5ULtlQaa/mrPwA
TLSH
T17E556C96A7A401EDC077C1F8C957D623E776BC091321AADB06D2F9662FB36E15B39300
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

712048

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

c:\Users\13602\Desktop\WQuake\WQuake_C++\x64\Release\WQuake.pdb

webview2loader

CreateCoreWebView2EnvironmentWithOptions

ws2_32

WSACloseEvent WSACreateEvent WSACleanup __WSAFDIsSet accept bind closesocket select listen WSAStartup getpeername send socket recv htonl inet_ntop htons setsockopt freeaddrinfo getaddrinfo ioctlsocket connect WSAGetLastError inet_pton WSAWaitForMultipleEvents WSAEventSelect WSAEnumNetworkEvents WSASetLastError

kernel32

CreateDirectoryW ReadFile FindFirstFileW FindNextFileW OutputDebugStringA FindClose CreateFileW GetFileAttributesW MultiByteToWideChar Sleep GetLastError OutputDebugStringW CloseHandle WideCharToMultiByte GetTickCount GetModuleFileNameW SetEnvironmentVariableW DeleteFileW MoveFileExW ExitProcess CreateProcessW CopyFileW MoveFileW SleepConditionVariableSRW MoveFileExA GetCurrentThreadId SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId InitializeSListHead RaiseException SetEvent ResetEvent CreateEventA FormatMessageA GetSystemTimeAsFileTime

user32

GetWindowLongW UpdateWindow GetMessageW DefWindowProcW PostMessageW SetProcessDpiAwarenessContext DestroyWindow CreateWindowExW PostQuitMessage RegisterClassExW ShowWindow DispatchMessageW MessageBoxA MoveWindow AdjustWindowRect TranslateMessage LoadIconW LoadCursorW GetClientRect GetSystemMetrics

advapi32

CryptReleaseContext CryptDestroyHash CryptHashData CryptCreateHash CryptAcquireContextW CryptGetHashParam

shell32

SHCreateDirectoryExW ShellExecuteW SHGetFolderPathW ShellExecuteExW

ole32

CoTaskMemFree

zlib1

deflateEnd deflate inflate deflateInit2_ inflateInit2_ inflateEnd

iphlpapi

GetAdaptersAddresses

msvcp140

?_Getctype@_Locinfo@std@@QEBA?AU_Ctypevec@@XZ ??1_Locinfo@std@@QEAA@XZ _Toupper _Tolower ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ??0ctype_base@std@@QEAA@_K@Z ??1ctype_base@std@@UEAA@XZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?uncaught_exception@std@@YA_NXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z _Cnd_signal _Query_perf_frequency _Query_perf_counter ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z _Thrd_detach _Xtime_get_ticks ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@G@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z ?_Random_device@std@@YAIXZ ?c_str@?$_Yarn@D@std@@QEBAPEBDXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ??0_Locinfo@std@@QEAA@PEBD@Z ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Throw_Cpp_error@std@@YAXH@Z ?uncaught_exceptions@std@@YAHXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Xbad_alloc@std@@YAXXZ ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?id@?$ctype@D@std@@2V0locale@2@A ?_Xlength_error@std@@YAXPEBD@Z _Mtx_lock _Cnd_do_broadcast_at_thread_exit _Thrd_id _Thrd_join _Mtx_unlock ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?width@ios_base@std@@QEAA_J_J@Z ?width@ios_base@std@@QEBA_JXZ ?flags@ios_base@std@@QEBAHXZ ?good@ios_base@std@@QEBA_NXZ ??7ios_base@std@@QEBA_NXZ ??Bios_base@std@@QEBA_NXZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Xbad_function_call@std@@YAXXZ ?_Syserror_map@std@@YAPEBDH@Z

winhttp

WinHttpAddRequestHeaders WinHttpQueryHeaders WinHttpReadData WinHttpOpenRequest WinHttpSetOption WinHttpOpen WinHttpReceiveResponse WinHttpSendRequest WinHttpSetTimeouts WinHttpConnect WinHttpCrackUrl WinHttpQueryDataAvailable WinHttpCloseHandle

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception_context __current_exception strstr __std_type_info_compare strchr __C_specific_handler memset memcmp memmove memcpy _CxxThrowException __std_terminate _purecall __std_exception_copy __std_exception_destroy

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswprintf_s fflush fclose __p__commode __stdio_common_vsprintf_s fgetc _set_fmode __acrt_iob_func fopen __stdio_common_vfprintf fputc setbuf ftell _get_stream_buffer_pointers _fseeki64 fread fsetpos ungetc setvbuf fgetpos __stdio_common_vsprintf fwrite fseek

api-ms-win-crt-heap-l1-1-0

_callnewh malloc _set_new_mode free calloc

api-ms-win-crt-math-l1-1-0

_dsign pow __setusermatherr

api-ms-win-crt-runtime-l1-1-0

_crt_atexit _cexit _seh_filter_exe _set_app_type _register_onexit_function _get_narrow_winmain_command_line _initterm _initterm_e exit _exit terminate _c_exit _register_thread_local_exe_atexit_callback _initialize_onexit_table _initialize_narrow_environment _beginthreadex _errno _configure_narrow_argv strerror

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file remove

api-ms-win-crt-locale-l1-1-0

_configthreadlocale localeconv

api-ms-win-crt-convert-l1-1-0

atoi strtol strtoull strtoll strtod

api-ms-win-crt-string-l1-1-0

strlen isalpha wcslen isspace strcmp strncpy tolower

api-ms-win-crt-time-l1-1-0

_gmtime64_s _time64

crypt32

CertCloseStore CertOpenStore CertEnumCertificatesInStore CertFreeCertificateContext

bcrypt

BCryptGenRandom